Swarm Builds an Agentic Bot Migration Tool for NYO on Amazon Bedrock AgentCore

NYO is the LLM gateway and router run by Nyolab, a specialist Hive within the Swarm network, together with Nyolab’s professional-services arm. Much of that professional-services work is Hermes bots that run agentic tasks on a client’s own machine.

When a client’s usage grows, the bot has to move to the cloud, onto an always-on instance with access to tools a laptop cannot offer. Each move is a small project. Someone has to design the target, rewrite paths and service units, move configuration, secrets and state, verify the result, cut over, and keep a way to roll back.

Done by hand, this work is slow and repeats for every client. It is prone to error, depends on the few engineers who know the Hermes internals, and takes the same engineers away from new client work. Left unaddressed, growth would be capped by engineer time. Ad hoc migrations would also handle secrets and production state with no approval record or audit trail. Because this move recurs for every client whose usage grows, it was a strong candidate for a reusable accelerator.

Swarm designed and built aws-porter as a single agent core that works across bots. It runs on Amazon Bedrock AgentCore Runtime as an ARM64 container in VPC mode, in the private subnets of a two-Availability Zone Amazon Virtual Private Cloud (Amazon VPC). Each session gets its own microVM, callers invoke it with AWS Identity and Access Management (IAM) SigV4 authentication, and tracing runs through AWS X-Ray. The agent loop is built with the Strands Agents SDK and has per-call budget, turn, time and token limits.

All model calls are routed through an AWS Lambda model proxy, which holds the model provider key and enforces a model allowlist and a per-call output ceiling. A second Lambda broker issues one-hour GitHub App tokens scoped to a single repository and allows only new branches and draft pull requests. As a result, the agent runtime itself holds no AWS write authority, GitHub credentials or model keys.

Amazon S3 stores repository snapshots and run reports, AWS Secrets Manager holds the two secrets, AWS CodeBuild and Amazon ECR produce immutable ARM64 images with a provenance record for each build, and AWS CDK defines all of the infrastructure.

Each bot is described by a strict profile and one of three adapters (HTTP service, Systems Manager service or AgentCore), and only allowlisted profile digests are accepted. A rubric grader must pass every check before the agent publishes its pull request. A separate executor then applies the deployment plan through AWS Systems Manager Run Command and AWS CloudFormation, but only after a person approves it. That approval is bound to the plan hash, account, Region and source revision, and every step is journaled with rollback available.

Swarm gave NYO a repeatable way to prepare a client bot’s move to the cloud. The engineering work that previously had to be redone for each client is now a single agent run, completing in 8 to 19 minutes on the recorded runs at a model cost of US$2.21 to US$12.22 per run.

Because the agent core is configured for each bot through a profile, NYO can take on a new bot of a known shape by writing a profile rather than building a new tool. This reduces the dependence on the few engineers who know the Hermes internals.

Every infrastructure change now carries an approval bound to a plan hash, a journal of each step and a tested rollback path, which closes the audit gap that manual migrations left. Human review stays in the loop: the agent prepares the work, and engineers check it and approve it.